OCC 2004-20 OCC Bulletin Subject: Risk Management of New, Expanded, or Modified Bank Products and Services Description: Risk Management Process Date: May 10, 2004 TO: Chief Executive Officers, Directors, and Compliance Officers of National Banks, Department and Division Heads, Compliance Officers, and All Examining Personnel PURPOSE This guidance reminds national banks of the process they should follow to prudently manage the risks associated with new, expanded, or modified bank products and services. Specifically, it outlines the expectations of the Office of the Comptroller of the Currency's (OCC's) expectations for banks' management and boards to implement an effective risk management process. The risk management principles outlined in this bulletin apply to the introduction of traditional and non-traditional bank products and services, as well as modifications to existing products and services. Modifications include changes in the terms or nature of an existing product or service that significantly alter the underlying risk characteristics of the product or service (e.g., significant changes in underwriting standards, geographic or industry focus). BACKGROUND During periods of reduced net interest margins, stagnant growth in traditional business lines, and increased competition, bank managementrs and directors face many challenges in seeking to improve the bank's financial performance. Engaging in new, expanded, or modified bank products or services is often considered a solution. However, if management and the board are overly focused on expected returns, do not have a good understanding of the inherent risks, or have poor governance practices, the bank's ability to effectively measure, monitor, and control the risks inherent in such products or services may be compromised. Recently, the OCC has seen banks that have not performed the necessary up-front analysis to determine whether a potential new, expanded, or modified product or service offers the appropriate risk-versus-return profile and is consistent with the bank's strategic direction. Additionally, some banks have failed to implement appropriate risk management controls and processes. In some cases, these oversight failures have resulted in costly errors, unwarranted risk exposures, and deviations from the bank's business plan. Some historically well-managed banks have found themselves faced with problems because bank management underestimated its need to manage, monitor, and control the development and implementation of a product or service. Instead of boosting net income, the product or service caused systems and control problems, resulting in credit losses, compliance issues, litigation exposure, unfavorable returns, and diminished reputation in the marketplace. RISK MANAGEMENT PROCESS The OCC expects bank management and the board to oversee all new, expanded, or modified products and services through an effective risk management process. Failure to provide an effective risk management process is an unsafe and unsound banking practice. An effective risk management process includes (1) performing adequate due diligence prior to introducing the product, (2) developing and implementing controls and processes to ensure risks are properly measured, monitored, and controlled, and (3) developing and implementing appropriate performance monitoring and review systems. The formality of the bank's risk management process should reflect the size of the bank and the complexity of the product or service offered. Depending on these factors, it may be appropriate for the bank to establish an executive management committee to oversee development and implementation of bank products and services. Due Diligence Before deciding to introduce a significant new, expanded, or modified product or service to bank customers, management and the board should conduct due diligence to ensure they have a realistic understanding of the risks and rewards of the product or service being considered. Management and the board should clearly understand the rationale for offering the product or service.1 The due diligence process should include: * Assessing how the risks associated with the new, expanded, or modified product or service fits with the bank's business strategy and risk profile. * Consulting with relevant functional areas, such as credit, compliance, accounting, audit, risk management, legal, operations, information technology, and marketing, as well as the Treasury/Asset Liability Committee (ALCO) , to determine risks, concerns, and necessary controls. * Determining requirements for complying with laws, regulations, and regulatory guidance. * Determining the expertise needed to effectively manage the product or service, including the possible need to acquire additional expertise. * Researching the background, experience, and reliability of relevant third parties. * Developing a business and financial plan for the product or service that assesses the bank's competitive position and establishes objectives and strategies for how the product or service will be brought to market. * Developing viable alternatives, including an exit strategy in the event the product or service fails to perform as expected. Although the board may delegate performance of managerial duties to others, it has the ultimate responsibility for ensuring that the bank is run in a safe and sound manner. In fulfilling its responsibilities, the board or its designee must ensure that a new, expanded, or modified bank product or service is consistent with the bank's strategic goals. Risk Management Controls and Processes Once the bank decides to introduce a new, expanded, or modified product or service and develops a business plan, the board and management should develop and implement adequate risk management processes to effectively control the risks of the activity. These ThisSteps should include: * Expanding and amending bank policies and procedures, as appropriate, to ensure that they adequately address the product or service. Policies and procedures should establish accountability and provide for exception monitoring. * Developing and implementing the information and reporting systems (MIS) necessary to monitor adherence to established objectives and to properly supervise the product or service. MIS reports should contain key indicators to allow the board and management to effectively identify, measure, monitor, and control risk. * Incorporating the product or service into the bank's audit and compliance processes to ensure adherence with bank policies and procedures and customer safeguards. Performance Monitoring Management and the board should have appropriate performance and monitoring systems in place to allow them to assess whether the product or service is meeting operational and strategic expectations. Such systems should: ú Include limits on the size of acceptable risk exposure that management and the board are willing to assume with the product or service. * Identify specific objectives and performance criteria to evaluate success of the product or service. The performance criteria should include quantitative benchmarks that will serve as a means to evaluate success of the product or service. * Reflect a process that periodically compares actual results with projections and qualitative benchmarks, to detect and address adverse trends or concerns in a timely manner. * Trigger changes in the business plan, when appropriate, based on the performance of the product or service. Such changes may include exiting the activity should actual results fail to achieve projections. Risk Management of Third Parties Unique risks are involved when a bank obtains new, expanded, or modified products and services through third-party vendors. Inferior performance or service on the part of a vendor mmay result in unexpected risks, including legal costs or loss of business to the bank. Although most vendors are reputable, their products may be unproven, or the risks associated with the product or service may conflict with bank safety and soundness standards or compliance requirements. In addition, the vendor's services may not be appropriate for the bank's unique market, personnel, or operating environment. These risks can be exacerbated by so-called "turn-key" arrangements that are designed to provide the bank with only minimal involvement in the administration and oversight of the product or service. Bank management must ensure that it understands the risks associated with the activity and conducts adequate due diligence of the vendor, including assessing the proposed vendor's reputation, products, and financial condition. Management must also implement an ongoing oversight program over the vendor's activities and develop a contingency plan in the event the vendor cannot perform as expected. Management should not overly rely on the vendor's assertions, representations, or warranties, but should do its own analysis to ensure the vendor and its products are a good fit for the bank. OCC Bulletin 2001-47, Third Party Relationships: Risk Management Principles, dated November 1, 2001, provides additional guidance to national banks on managing the risks associated with third- party vendors. This bulletin is available through the OCC Web site at http://www.occ.treas.gov/. ASSOCIATED RISKS Poor planning, oversight, or control may lead to an incomplete assessment and understanding of the risks involved with new, expanded, or modified bank products and services. This section highlights the primary risks that arise in the theirtheir development and introduction. Strategic Risk: The risk to earnings or capital arising from adverse business decisions or improper implementation of those decisions. Strategic risk arises when a bank offers products and services that are not compatible with the bank's strategic goals or that do not provide an adequate return on investment. This kind of risk increases when management introduces new, expanded, or modified products or services without performing adequate due diligence reviews or without implementing an appropriate risk management infrastructure to oversee the activity. Strategic risk also increases when management does not have adequate expertise and experience to properly oversee these products or services. Reputation Risk: The risk to earnings or capital arising from negative public opinion. Reputation risk occurs when a bank offers new, expanded, or modified products or services without fully understanding its customers' business objectives or the economic purposes of the transaction. Reputation risk also arises when a bank stretches for income by offering products or services that involve practices or techniques that differ from the bank's standards. Reputation risk increases with poor service, inappropriate sales recommendations, or violations of consumer law, any of which may result in litigation, adverse publicity, and loss of business. Using third parties to offer products or services, or expanding the use of existing third parties, may also expose the bank to reputation risk. This risk increases when bank management fails to closely monitor the quality and appropriateness of the provider's products or services. In cases where third-party employees interact directly with bank customers, reputation risk increases if interactions are inconsistent with the bank's policies, practices, and standards. Credit Risk: The risk to earnings or capital arising from an obligor's failure to meet the terms of any contract with the bank or otherwise fail to perform as agreed. Credit risk arises any time bank funds are extended, committed, invested, or otherwise exposed through actual or implied contractual agreements, whether reflected on or off the balance sheet. Since credit risk is found in all activities where success depends on counter-party, issuer, or borrower performance, it is often a key risk in new, expanded, or modified bank products and services. Transaction Risk: The risk to earnings or capital arising from problems with service or product delivery. A bank is exposed to transaction risk when products, services, or delivery channels do not fit with the bank's operational capacity, customer demands, or strategic objectives. Transaction risk can increase with the implementation of new information technology to support a new, expanded, or modified product or service. Failed or flawed technology, either from error, inadequate capacity, or fraud, may result in the inability to deliver products or services. Compliance Risk: The risk to earnings or capital arising from violations of laws, rules, or regulations, or from nonconformance with internal policies and procedures or ethical standards. Compliance risk arises when new, expanded, or modified bank products or services are not properly monitored for compliance with law, ethical standards, or the bank's policies and procedures. The potential for serious or frequent violations or noncompliance increases when a bank's oversight program does not include appropriate audit and control features. Compliance risk increases when the privacy of customer records is not protected, when conflicts of interest between a bank and affiliated third parties are not appropriately managed, and when a bank or its service providers have not implemented appropriate information security programs. Compliance risk also increases from inadequate accounting practices. Other Potential Risks: Depending on the product or service, a bank may be subject to increased liquidity, interest rate, price, or even foreign currency translation risk. Such risks will increase if bank management does not have a solid understanding of all risks involved with proposed products and services and does not take all appropriate steps to control risks prior to introducing the product or service. SUPERVISORY MONITORING The OCC's primary supervisory objective is to ensure that a bank does not assume more risk than it can effectively manage. As part of ongoing supervision, OCC examiners will review significant new, expanded, or modified bank products and services, consistent with the OCC's supervision-by-risk framework. In particular, examiners will consider a product or service's impact on the bank's risk profile, and the effectiveness of a bank's product risk management program, including due diligence and oversight monitoring efforts. Examiners will be critical of banks that have not established appropriate risk management processes. Bank management should discuss their plans with their OCC examiner-in-charge or supervisory office before developing and implementing new, expanded, or modified products or services, particularly if the new activity constitutes a significant deviation from the bank's existing business plan.2 RESPONSIBLE OFFICE Questions concerning this guidance should be directed to Operational Risk at (202) 874-5190, or to Risk Evaluation at (202) 874-4660. _______________________________ ______________________________ Mark L. O'Dell Kathryn E. Dick Deputy Comptroller, Deputy Comptroller, Operational Risk Risk Evaluation _______________________________ 1 A topical list of regulatory guidance addressing new or expanded bank products and services is attached. These reference materials are available through the OCC Web site at http://www.occ.treas.gov/. . 2 As part of its current practice, the OCC conditions approvals of certain licensing applications (charters, conversions, and other applications, where appropriate) upon the national bank giving the OCC's supervisory office prior notice of any significant deviation to the bank's operating plan. SUBJECT ISSUANCE DATE DESCRIPTION ACH Transactions OCC Bulletin 2002-2 January 2002 Provides guidance on ACH transactions involving the Internet Accounts Receivable Comptroller’s March 2000 Describes selected risks and Inventory Handbook associated with accounts Financing receivable and inventory financing Business Continuity FFIEC IT Examination March 2003 Includes guidance on Planning Handbook business continuity planning Community Comptroller’s May 1999 Provides guidance on CRA Reinvestment Act Handbook exam process and Examination evaluation. Procedures Commercial Real Comptroller’s November 1995 Describes selected risks Estate and Handbook associated with commercial Construction Lending real estate and construction lending Community Bank Comptroller’s July 2003 Includes discussion of Supervision Handbook strategic and reputation risk in community banks Credit Card Lending Comptroller’s October 1996 Describes specific aspects Handbook of credit card lending Credit Card OCC Bulletin 2003-1 January 2003 Communicates FFIEC Lending: Account expectations for prudent Management and account management, risk Loss Allowance management, and loan loss Guidance practices in the area of credit card lending. Custody Services Comptroller’s January 2002 Addresses the Handbook fundamentals of securities custody and related services. Floor Plan Loans Comptroller’s March 1990 Describes specific aspects Handbook of floor plan loans Information FFIEC IT Examination December 2002 Provides guidance on Security Handbook information security Insurance Comptroller’s June 2002 Describes specific aspects Activities Handbook of insurance activities Internet Banking Comptroller’s October 1999 Describes selected risks Handbook associated with Internet banking Investment Comptroller’s August 2001 Includes information on Management Services Handbook (Asset investment management Management) services Investment OCC Bulletin 2002-39 September 2002Alerts banks to the Portfolio Credit potentially significant Risks: Safekeeping credit risks they incur Arrangements when safekeeping investment portfolio assets with third parties Lease Financing Comptroller’s January 1998 Describes specific aspects Handbook of lease financing Merchant Processing Comptroller’s December 2001 Describes specific aspects Handbook of merchant processing Mortgage Banking Comptroller’s March 1996 Describes specific aspects Handbook of mortgage banking Payment Systems Comptroller’s March 1990 Describes specific aspects and Funds Transfer Handbook of payment systems and funds Activities transfer activities Personal Fiduciary Comptroller’s August 2002 Includes relevant Services Handbook (Asset information on personal Management) fiduciary services Predatory and OCC Advisory February 2003 Provides guidelines to guard Abusive Lending Letter 2003-2 against predatory and Practices abusive lending practices Predatory and OCC Advisory February 2003 Provides discussion on Abusive Lending Letter 2003-3 avoidance of predatory and Practices abusive lending practices in brokered and purchased loans Purchases of Loans OCC Banking August 1984 Describes appropriate In Whole or In Part Circular 181 practices for the purchase – Participations of loans and loan participations Retail Nondeposit Comptroller’s February 1994 Describes specific aspects Investment Sales Handbook of retail nondeposit investment sales Risk Management of OCC Advisory November 2000 Transmits FFIEC guidance on Outsourcing Letter 2000-12 risk management practices Technology when outsourcing technology services, including information and transaction processing and Internet banking activities Subprime Lending OCC Bulletin March 1999 Provides interagency 1999-10 guidance on risk management of higher risk retail credit products. Subprime Lending OCC Bulletin April 1999 Provides additional guidance 1999-15 on risk management of higher risk retail credit products. Subprime Lending OCC Bulletin January 2001 Supplements interagency 2001-6 guidance issued in March 1999 on subprime lending. Third-Party OCC Bulletin November 2001 Provides detailed guidance Relationships: Risk 2001-47 on managing risks from Management business relationships with Principles third parties Third-Party Risk OCC Advisory August 2000 Alerts banks to potential Letter 2000-9 credit risks arising from arrangements with third parties and emphasizes the importance of thorough due diligence and control over such risks Third-Party Service OCC Bulletin May 2002 Provides guidance on risk Providers 2002-16 management for foreign-based third-party service providers Unfair or Deceptive OCC Advisory March 2002 Provides guidance on unfair Acts or Practices Letter 2002-3 or deceptive acts or practices Unsafe and Unsound OCC 2002-19 May 2002 Provides guidance on Investment Portfolio investment portfolio Practices practices